[ntp:questions] Re: handling of falsetickers with dumb NTP clients

David L. Mills mills at udel.edu
Fri Sep 12 02:07:54 UTC 2003


Danny,

There is a great deal of additional discussion on security issues,
especially circular dependencies other than you mention, on the NTP
project page and documents at www.eecis.udel.edu/~mills/reports.html.
The NTP security model in and of itself specifically does not use DNS
for much the same reason you mention. In other painful words, time and
security are inseparable in themselves, but must be separable from name
resolution. The purist cannot turn up bind unless NTP has synchronized
the clock.

I was testing the NTP response to really wacky times and kept getting
security errors until I realized that the certificates became invalid at
the wacky times and the Autokey protocol did exactly as expected. This
brings new light on the discussion about just how far wacky the time can
be before the daemon gives up and calls for assistance.

Dave

Danny Mayer wrote:
> 
> "David L. Mills" <mills at udel.edu> wrote in message news:<3F5E8479.727FB1E2 at udel.edu>...
...
> 
> Well NTP and DNS, or at least BIND, have a somewhat Tweedledum-Tweedledee
> realtionship. They both are dependent on each other. NTP needs DNS to
> lookup and get IP addresses, and BIND needs an accurate source of time
> especially for security-related connections.
> 
> Danny



More information about the questions mailing list